diff --git a/app-code/api/account/update_user_data.php b/app-code/api/account/update_user_data.php index 4b8320f..e5436f3 100644 --- a/app-code/api/account/update_user_data.php +++ b/app-code/api/account/update_user_data.php @@ -43,7 +43,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { } // Sanitize and validate the input - $name = preg_replace("/[^a-zA-Z0-9_]/", "", $data['name']); // Allow only letters, numbers, and underscores + $name = strtolower(preg_replace("/[^a-zA-Z0-9_]/", "", $data['name'])); $email = trim((string) $data['email']); if ($email !== "" && !filter_var($email, FILTER_VALIDATE_EMAIL)) { echo json_encode([ @@ -52,7 +52,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { ]); exit(); } - $telegram_id = htmlspecialchars($data['telegram_id'], ENT_QUOTES, 'UTF-8'); // Escape special characters + $telegram_id = htmlspecialchars($data['telegram_id'], ENT_QUOTES, 'UTF-8'); //check if username is allready taken $id_check=0; @@ -63,8 +63,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { mysqli_stmt_store_result($stmt); mysqli_stmt_bind_result($stmt, $id_check); mysqli_stmt_fetch($stmt); - if(mysqli_stmt_num_rows($stmt) > 0 && $username!==$name){ - //this username is allready taken + if((mysqli_stmt_num_rows($stmt) > 0 && $username!==$name) || $name === ""){ echo json_encode([ 'success' => false, 'message' => 'Username allready taken. Please choose another username.' diff --git a/app-code/api/login/send_reset_link.php b/app-code/api/login/send_reset_link.php index cf57d76..7128ab9 100644 --- a/app-code/api/login/send_reset_link.php +++ b/app-code/api/login/send_reset_link.php @@ -35,7 +35,6 @@ if (!$user_found) { } //send telegram message $device = $_SERVER['HTTP_USER_AGENT'] ?? ""; -//$ip=$_SERVER["REMOTE_ADDR"]; $forwarded_for = $_SERVER["HTTP_X_FORWARDED_FOR"] ?? $_SERVER["REMOTE_ADDR"] ?? ""; $ip=trim(explode(",",$forwarded_for)[0]); $location=get_location_from_ip($ip); @@ -44,15 +43,20 @@ $token=bin2hex(random_bytes(128)); $token_hash=auth_token_hash($token); $link="https://auth.jakach.ch/login/reset_pw.php?token=$token"; +$tg_device = str_replace(['_', '*', '[', ']', '(', ')', '~', '`', '>', '#', '+', '-', '=', '|', '{', '}', '.', '!'], ['\\_', '\\*', '\\[', '\\]', '\\(', '\\)', '\\~', '\\`', '\\>', '\\#', '\\+', '\\-', '\\=', '\\|', '\\{', '\\}', '\\.', '\\!'], $device); +$tg_username = str_replace(['_', '*', '[', ']', '(', ')', '~', '`', '>', '#', '+', '-', '=', '|', '{', '}', '.', '!'], ['\\_', '\\*', '\\[', '\\]', '\\(', '\\)', '\\~', '\\`', '\\>', '\\#', '\\+', '\\-', '\\=', '\\|', '\\{', '\\}', '\\.', '\\!'], $_SESSION["username"]); +$tg_ip = str_replace(['_', '*', '[', ']', '(', ')', '~', '`', '>', '#', '+', '-', '=', '|', '{', '}', '.', '!'], ['\\_', '\\*', '\\[', '\\]', '\\(', '\\)', '\\~', '\\`', '\\>', '\\#', '\\+', '\\-', '\\=', '\\|', '\\{', '\\}', '\\.', '\\!'], $ip); +$tg_location = str_replace(['_', '*', '[', ']', '(', ')', '~', '`', '>', '#', '+', '-', '=', '|', '{', '}', '.', '!'], ['\\_', '\\*', '\\[', '\\]', '\\(', '\\)', '\\~', '\\`', '\\>', '\\#', '\\+', '\\-', '\\=', '\\|', '\\{', '\\}', '\\.', '\\!'], ($location["country"] ?? "").", ".($location["state"] ?? "").", ".($location["city"] ?? "")); + $message = "*Password reset token*\n\n" . "You have requested the reset of your password here is your reset link.\n\n" . "*Link*: [click here]($link)\n\n" . "*Details of this request:*\n" . "• *Date&Time*: $date\n" - . "• *Device&Browser*: $device\n" - . "*Location*: ".$location["country"].", ".$location["state"].", ".$location["city"]."\n" - . "• *Account*: ".$_SESSION["username"]."\n" - . "• *IP*: $ip\n\n" + . "• *Device&Browser*: $tg_device\n" + . "*Location*: $tg_location\n" + . "• *Account*: $tg_username\n" + . "• *IP*: $tg_ip\n\n" ."If this was you, you can reset your password. If this was not you somebody else tried to reset your password!\n" . "*Thank you for using Jakach login!*"; @@ -78,6 +82,12 @@ curl_close($ch); //send mail if(!empty($mail)){ $loc=$location["country"].", ".$location["state"].", ".$location["city"]; + $html_username = htmlspecialchars($username, ENT_QUOTES, 'UTF-8'); + $html_device = htmlspecialchars($device, ENT_QUOTES, 'UTF-8'); + $html_ip = htmlspecialchars($ip, ENT_QUOTES, 'UTF-8'); + $html_loc = htmlspecialchars($loc, ENT_QUOTES, 'UTF-8'); + $html_mail = htmlspecialchars($mail, ENT_QUOTES, 'UTF-8'); + $html_link = htmlspecialchars($link, ENT_QUOTES, 'UTF-8'); $content = ' @@ -89,433 +99,67 @@ if(!empty($mail)){ - Use this link to reset your password. The link is only valid for 12 hours. @@ -525,31 +169,24 @@ if(!empty($mail)){ -